The Gentlemen Ransomware Operation Ransomware: GentleKiller Framework Disables Security Software (June 2024)

The Gentlemen Ransomware-as-a-Service Operation: What Happened

The Gentlemen Ransomware-as-a-Service Operation has developed and deployed the GentleKiller framework, a toolkit engineered to disable endpoint security software prior to ransomware execution. This framework specifically targets and terminates over 400 security products, including solutions from Microsoft Defender and CrowdStrike, by exploiting vulnerable signed kernel drivers. The group has leveraged this capability to increase the success rate and stealth of their ransomware attacks, impacting organizations primarily in Southeast Asia, South America, and Western Europe. The attacks have been confirmed to bypass standard endpoint protection, allowing ransomware to execute and encrypt systems without detection or interruption.

Attack Vector & Technical Detail

The attack chain begins with the deployment of the GentleKiller framework, which exploits vulnerable signed kernel drivers to gain privileged access at the kernel level. By operating at this level, GentleKiller is able to terminate running processes associated with security software from approximately 48 vendors, effectively neutralizing endpoint defenses. The framework does not rely on specific CVEs but leverages the inherent trust of signed drivers to bypass security controls. The MITRE ATT&CK tactics observed in these incidents include Defense Evasion (TA0005) and Discovery (TA0007), reflecting the adversary’s focus on disabling protections and mapping the environment before ransomware payload deployment. No specific IOCs or CVEs have been publicly disclosed for this campaign.

Confirmed Impact

The confirmed impact includes the successful disabling of security software across a wide range of organizations, with a focus on high-value targets in Southeast Asia, South America, and Western Europe. The framework’s ability to bypass products from multiple vendors, including industry leaders like Microsoft and CrowdStrike, significantly increases the risk of undetected ransomware deployment and subsequent data encryption. This raises the likelihood of operational disruption, data loss, and potential regulatory consequences for affected organizations, particularly those subject to data protection laws in the impacted regions. The global reach of the Gentlemen Ransomware-as-a-Service Operation underscores the elevated threat posed by adversaries with advanced evasion capabilities.

What This Means for Your Organization

The use of the GentleKiller framework highlights the importance of monitoring for unauthorized driver installations and kernel-level activity. Organizations should review endpoint protection configurations and ensure that only trusted, up-to-date drivers are permitted. Security teams must adopt a defense-in-depth approach, incorporating behavioral monitoring and application whitelisting to detect and prevent unauthorized process termination. Proactive threat hunting for signs of driver abuse and rapid response to suspicious activity are critical to mitigating the risk posed by advanced ransomware operations.

Detection & Response

• Immediate: Audit all endpoints for unauthorized or suspicious signed kernel drivers and review security software integrity.
• Hunt: Monitor for anomalous process terminations and attempts to load or exploit signed kernel drivers, especially those associated with security products.
• Patch: N/A (no specific CVEs disclosed for this campaign).

Source: https://www.infosecurity-magazine.com/news/gentlekiller-gentlemen-ransomware/